Subject: RE: [mobile-ip] fastv6 and CoAs

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Mon, 23 Sep 2002 23:55:36 +0200

James,

  > The ingress filter won't stop someone spoofing a /64 on the 
  > subnet. 

=> Please explain. Why? This is the whole purpose
of ingress filtering.

It also
  > won't stop someone from spoofing a /128.

=> Agreed. It wasn't designed for that.

  > 
  > So what I am saying is that ingress filtering is irrelevent 
  > to this discussion.
  > An attacker can spoof a valid prefix on the subnet 
  > regardless of whether it is a
  > /64 or a /128. 

=> Can you please give an example of spoofing a /64? 

Once the /128 has been securely set up, it 
  > is like any other
  > address on the link. There is currently no way for a router 
  > to determine whether
  > a node claiming to have the right to use a particular 
  > address does, in fact,
  > have that right. CGA and some of the other techniques we 
  > are talking about in
  > the SEND discussion may, in fact, provide this capability. 
  > If so, then the
  > ability of a node to spoof any address on the link will be 
  > removed because the
  > router can check whether it has the right to claim the address
  > 
  > What exactly am I missing here?

=> That you can't spoof a prefix when ingress filtering
is used. 

Hesham

  > 
  >             jak
  > 
  > ----- Original Message -----
  > From: "Hesham Soliman (EAB)" <[email-masked]>
  > To: "'James Kempf '" <[email-masked]>; "Hesham 
  > Soliman (EAB)"
  > <[email-masked]>; <[email-masked]>
  > Sent: Saturday, September 21, 2002 2:34 PM
  > Subject: RE: [mobile-ip] fastv6 and CoAs
  > 
  > 
  > >
  > >
  > > So here's how I see this working:
  > >
  > > 1) Old AR and new AR have a security association.
  > >
  > > 2) Old AR and new AR exchange HI/HaCK with old CoA and L2 
  > id of MN about
  > > to
  > > undergo handover. New AR agrees to handle the tunnel.
  > >
  > > 3) New AR inserts a source route, and simultaneously modifies its
  > > ingress filter
  > > so that packets from old CoA originating on the air 
  > interface side will
  > > get
  > > routed into the tunnel interface.
  > >
  > > 4) MN shows up on new link, starts sending all packets 
  > with old CoA to
  > > new AR.
  > >
  > > 5) New AR checks against source routes, old CoA matches, 
  > link layer
  > > address
  > > matches, routes down the tunnel.
  > >
  > > Let's consider some attacks:
  > >
  > > 1) Attacker on the air interface side starts sending 
  > packets with the
  > > old CoA
  > > and the link layer address (both need to be spoofed in 
  > order to pass the
  > > ingress
  > > filter). The router will route down the tunnel.
  > >
  > > 2) Attacker on the air interface side starts sending 
  > packets with a
  > > vaild CoA on
  > > the subnet and a valid link layer address of another node 
  > on the subnet.
  > > The
  > > router routes the packet out.
  > >
  > > So I guess I don't see much difference. Or did you have a 
  > different
  > > threat in
  > > mind?
  > >
  > > => Threat 1 is what I had in mind. Like I said there
  > > is a difference. The difference is: ingress filtering
  > > _stops_ threat 1). We're violating that.
  > >
  > >
  > > As Section 1 of RFC 2267 says:
  > >
  > >    While the filtering method discussed in this document does
  > >    absolutely nothing to protect against flooding attacks which
  > >    originate from valid prefixes (IP addresses), it will 
  > prohibit an
  > >    attacker within the originating network from launching 
  > an attack of
  > >    this nature using forged source addresses that do not 
  > conform to
  > >    ingress filtering rules.
  > >
  > > => That's exactly what I've been saying.
  > >
  > > The source route makes the old CoA a valid (/128) prefix 
  > on the subnet,
  > > because
  > > it is established by a secure transaction between the routers.
  > >
  > > => The point is, the secure transaction between
  > > routers is irrelevant to this discussion. What
  > > you're saying above can be reworded to say:
  > > "The source route makes the old CoA a valid (/128) prefix on the
  > > subnet, hence allowing for new attacks that ingress filtering
  > > is meant to stop".
  > >
  > > Hesham
  > >
  > >
  > >
  >

---

From: "James Kempf" <[email-masked]>
Date: Mon, 23 Sep 2002 16:03:29 -0700

> => Please explain. Why? This is the whole purpose

Suppose that the prefix on the link is X. Now suppose the attacker uses an
address X:Y, where Y is some other node's interface identifier. The ingress
filter can't stop that. It will only stop an attacker using a prefix A, where A
!= X.

> => Can you please give an example of spoofing a /64?

See above.

> => That you can't spoof a prefix when ingress filtering

I think we are talking about two different kinds of spoofing. What I mean is
that the attacker can spoof any address with a valid prefix on the link,
regardless if the prefix is a /128 or a /64. I don't mean that it can spoof a
different prefix, which the router is not routing.

            jak